Cyber Threat Intelligence

5Generating Intelligence

Intelligence teams are well placed to understand their consumers' needs. Armed with this awareness, teams can synthesise intelligence and information into tailored reports that satisfy their customers, and contribute to improving the security posture. Similarly, teams that understand the operating environment of their organisation, and have access to data that is unavailable to others, are in an ideal situation to transform that data into intelligence reports.

Such intelligence is not only useful within our own organisations to guide decision makers, but also useful to external entities. Sharing intelligence is not just an altruistic act destined to strengthen and protect the ‘herd’ against attack. External entities can provide valuable feedback or enrich reports with additional context and details not available to the original authors. At the very least, creating a culture of share and share alike provides long term benefits for everyone.

Nevertheless, not all intelligence is equal. Teams need to be aware of the nature of their audience, their needs and expectations. Equally, produced intelligence needs to be clear. Strategic intelligence reports are written for senior decision makers to help make long term decisions. Operational intelligence reports are written for operational decision makers, providing information regarding the current environment for the near to medium future. Tactical reports describe the current situation and are often written ...